Automatically Determining Requirements for Provisioning A Hosted Computing Environment

ABSTRACT

Systems and methods are provided for provisioning a hosted computing environment in accordance with customer requirements relating to a service, in some embodiments, a computer-implemented method is provided. The method includes generating a graphical interface on a computing device and receiving input corresponding to an indication of one or more requirements, wherein the input is received using the graphical interface arid wherein the one or more requirements correspond to a hosted computing environment. The method further comprises converting each indication of the one or more requirements into one or more entries of a provisioning template, wherein the provisioning template includes multiple entries, and wherein the provisioning template is associated with the hosted computing environment. The method further comprises providing the provisioning template to a provisioning program to provision the hosted computing environment.

CROSS-REFERENCE TO RELATED APPLICATION(S)

This application is a continuation of U.S. patent application Ser. No.13/956,030 titled “PROVISIONING OF CLOUD NETWORKS WITH SERVICES”, filed31 Jul. 2013 (Attorney Docket No. 112509-8048.US00). The priorityapplications are incorporated by reference.

TECHNICAL FIELD

The present disclosure relates generally to computer-implemented systemsand methods for provisioning public or private cloud networks andservices.

BACKGROUND

Provisioning of a network involves the preparation and setup of variousnetwork components in accordance with a service provided to a customerfrom a service provider. The commands used to provision a network arecomplex and require technical knowledge of an underlying programminglanguage A user that is aware of the type of services they desire may beuninformed as to the technical requirements that are needed to provisionthe network to perform these services. As a result, the user is facedwith a problem of how to create the configuration files needed toprovision the network,

SUMMARY

The systems and methods of the present disclosure have several features,no single one of which is solely responsible for the desirableattributes described herein Without limiting the scope of thisapplication as expressed by the claims which follow, some prominentfeatures will now be described herein. After considering thisdiscussion, and particularly after reading the section entitled“Detailed Description of Certain inventive Embodiments,” one willunderstand how the features of this invention provide several advantagesover existing network, provisioning systems and methods.

In accordance with the teachings: provided herein, systems and methodsfor provisioning a hosted computing environment in accordance withcustomer requirements relating to a service are provided. In someembodiments, a computer-implemented method is provided. The methodcomprises generating a graphical interface on a computing device andreceiving input corresponding to an indication of one or morerequirements, wherein the input is received using the graphicalinterface, and wherein the one or more requirements correspond to ahosted computing environment. The method further comprises convertingeach indication of the one or more requirements into one or more entriesof a provisioning template, wherein the provisioning template includesmultiple entries, and wherein the provisioning template is associatedwith the hosted computing environment. The method further comprisesproviding the provisioning template to a provisioning program toprovision the hosted computing environment.

In some embodiments, a system is provided. The system comprises one ormore data processors and a non-transitory computer-readable storagemedium containing instructions which when executed on the one or moredata processors, cause the one or more processors to perform operationsincluding generating a graphical Interface on a computing device andreceiving input corresponding to an indication of one or morerequirements, wherein the input is received using the graphicalinterface, and wherein the one or more requirements correspond to shosted computing environment. The one or more operations further includeconverting each indication of the one or more requirements into one ormore entries of a provisioning template, wherein the provisioningtemplate Includes multiple entries, and wherein the provisioningtemplate is associated with the hosted computing environment. The one ormore operations further include providing the provisioning template to aprovisioning program to provision the hosted computing environment.

In some embodiments, a computer-program product tangibly embodied In anon-transitory machine-readable storage medium is provided. Thecomputer-program product includes Instructions configured to cause oneor more data processors to generate a graphical interface on a computingdevice and receive input corresponding to an indication of one or morerequirements, wherein the input Is received using the graphicalinterface, and wherein the one or more requirements correspond to ahosted computing environment. The computer-program product furtherincludes instructions configured to cause one or more data processors toconvert each indication of the one or more requirements into one or moreentries of a provisioning template, wherein the provisioning templateincludes multiple entries, and wherein the provisioning template isassociated with the hosted computing environment. The computer-programproduct further includes instructions configured to cause one or moredata processors to provide the provisioning template to a provisioningprogram to provision the hosted computing environment.

The details of one or more embodiments of the invention are set forth inthe accompanying drawings and the description below. Other features,aspects, and advantages of the invention will become apparent from thedescription, the drawings, and the claims.

BRIEF DESCRIPTION OF THE DRAWINGS:

The present disclosure is described in conjunction with the appendedfigures;

FIG. 1 shows a block diagram of an embodiment of a system for providingindexing, storing, and searching of data.

FIG. 2 shows a block diagram of an embodiment of a data managementsystem;

FIG. 3 illustrates a flowchart of an embodiment of a process for storingand using big data;

FIG. 4 shows a block diagram of an embodiment of a system implemented ina hosted computing environment;

FIG. 5 shows a block diagram of an embodiment of a build system;

FIG. 6 illustrates an exemplary embodiment of a graphical interface;

FIG. 7 illustrates another exemplary embodiment of a graphicalinterface:

FIG. 8 illustrates a flowchart of an embodiment of a process forprovisioning a hosted computing environment with services;

FIG. 9 illustrates a flowchart of another embodiment of a process forprovisioning a hosted computing environment with services; and

FIG. 10 shows an exemplary embodiment of a provisioning template.

Like reference numbers and designations in the various drawings indicatelike elements.

DETAILED DESCRIPTION

The ensuing description provides preferred exemplary embodiment(s) onlyand is not intended to limit the scope, applicability or configurationof the. disclosure. Rather, the ensuing description of the preferredexemplary embodiment(s) will provide those skilled in the art with anenabling description for implementing a preferred exemplary embodiment.It is understood that various changes can be made in the function andarrangement of elements without departing from the spirit and scope asset forth in the appended claims.

As used herein, the singular forms “a”, “an”, and “the” include bothsingular and plural referents unless the context clearly dictatesotherwise.

The terms “comprising,” “comprises” and “comprised of’ as used hereinare synonymous with “including” “includes” or “containing,” “contains,”and are inclusive or open-ended and do not exclude additional,non-recited members, elements or method steps. The terms “comprising,”“comprises,” and “comprised of” when referring to recite components,elements or method steps also Include embodiments which “consist of”said recited components, elements or method steps.

Furthermore, the terms first, second, third arid the like in thedescription and in the claims, are used for distinguishing between twoor more elements and not necessarily for describing a quantity or asequential or chronological order, unless specified. It is to beunderstood that the terms so used are interchangeable under appropriatecircumstances and that the embodiments of the invention describedherein: are capable of operation in other sequences than described orillustrated herein. Thus, a reference to first and second elements; forexample, does not necessarily mean that only two elements may beemployed or that the first element must precede the second element insome manner. Also, unless stated otherwise, a set of elements maycomprise one or more elements.

Reference throughout this specification to “one embodiment,” “anembodiment,” “some aspects,” “an aspect,” or “one aspect” means that aparticular feature, structure or characteristic described in connectionwith the embodiment or aspect is Included in at least one embodiment ofthe present invention. Thus, appearances of the phrases “in oneembodiment,” “In an embodiment” “some aspects,” “an aspect,” or “oneaspect” in various places throughout this specification are notnecessarily all referring to the same embodiment or aspects, but may.Furthermore, the particular features, structures or characteristics maybe combined in any suitable manner, as would be apparent to a personskilled in the art from this disclosure, in one or more embodiments oraspects. Furthermore, while some embodiments or aspects described hereininclude some but not other features included in other embodiments oraspects, combinations of features of different embodiments or aspectsare meant to be within the scope of the invention, and form differentembodiments or aspects, as would be understood by those in the art. Forexample, in the appended claims, any of the features of the claimedembodiments or aspects can be used in any combination.

A cloud computing network is an example of a hosted computingenvironment. Cloud network resources may be shared by multiple users orcustomers and may also be dynamically re-allocated as the demand fromdifferent users changes. Accordingly, cloud computing allows sharing ofnetwork resources and services, provides consistency of service, andachieves, economies of scale over a network.

Clients or customers may obtain services from service providers that runon a hosted computing environment. In order for the client or customerto have the desired service operate on the hosted computing environment,the hosted computing environment must be provisioned so that the variouscomponents of the environment are configured for network operation usingthe service. Provisioning of a hosted computing environment involves thepreparation and setup of the various network components in accordancewith the desired service. The commands used to provision the network arecomplex and require technical knowledge of an underlying programminglanguage. Accordingly, systems and methods are needed to provide userswith the ability to provision a hosted computing environment, withoutrequiring the users to have any technical knowledge relating to thecommands required to configure the environment.

In some embodiments, an exemplary client, customer, or other user mayinclude a company that desires a service that allows the client's datato be collected, analyzed, and secured into a data store. The customermay use a service from a service provider that, collects its data,indexes the data, and allows the customer to search the data. Theservice may also provide reporting and statistical analysis of the datafor the customer. In some embodiments, the data may be machine data. Asused herein, the term “machine data” may include data generated bymachines of a customer. Examples of machine data include server logs,application logs, business process logs, web access logs, web proxylogs, clickstream data, configuration data, data from applicationprogramming interfaces (APIs) and message queues, change events, theoutput of diagnostic commends and call detail records, sensor data fromremote equipment, message queues, and the like. In some embodiments,machine data streams may be segmented into events and time stamped tocreate time stamped events. In some embodiments, the machine data may beunstructured data, structured data, and/or a combination thereof. Asused herein, the term “unstructured data” may refer to data that doesnot include at least one predefined field. Details relating to machinedata, time stamped events, and unstructured data will be describedfurther below with respect to FIGS. 2 and 3.

FIG. 1 illustrates a block diagram of an embodiment of a system 1000 forproviding Indexing, storing, and searching of data. The system 1000 maycollect data from one or more clients or customers, index the data, andallow the clients or customers to search the data. The system 1000includes a cluster 1010. The cluster 1010 Includes a cluster master 1020that manages the cluster. The cluster 1010 further includes s searchhead 1030 for coordinating searches across indexers 1040-1, 1040-2,1040-3. The indexers 1040-1, 1040-2, 1040-3 provide: indexing,replication, and searching functions. The system 1000 further includesforwarders 1050-1, 1050-2 that ingest forward data to the indexers1040-1, 1040-2, 1040-3.

The search head 1030 receives search queries from clients or customersrequesting a search of client data. The search head 1030 coordinates allsearches and manages searches across the set of indexers 1040-1, 1040-2,1040-3 in some embodiments, the cluster master 1020 informs the searchhead 1030 which indexers are to be used by the search head 1030. Thesearch head 1030 distributes search queries to the indexers 1040-1,1040-2, 1040-3, and receives search results from each indexer. Thesearch head 1030 then consolidates the results returned by the indexers1040-1, 1040-2, 1040-3, and returns the consolidated results to theclient or customer.

The indexers 1040-1, 1040-2, 1040-3 perform indexing functions for thecluster 1000 by receiving and indexing incoming raw data. In someembodiments, the indexers 1040-1, 1040- 2, 1040-3 store the indexed datafor searching by a client, customer, or other user. In some embodiments,the indexed data is stored in a separate storage device. In someembodiments, one or more of the indexers 1040-1, 1040-2, 1040-3 may sendreplicated data to other Indexers 1040-1, 1040-2, 1040-3 in the clusterand may receive replicated data from the other Indexers In someembodiments, an indexer 1040-1, 1040-2, or 1040-3 may index receiveddata while simultaneously receiving and sending replicated data to otherindexers 1040-1 1040-2, or 1040-3. In response to search requestsreceived from the search head 1030, indexers 1040-1 1040-2, 1040-3 maysearch across their indexed data.

The cluster master 1020 provides management functions for the cluster,including coordinating the replicating activities of the indexers1040-1, 1040-2 1040-3. The cluster master 1020 may also inform thesearch head, 1030 where to find data among the indexers 1040-1, 1040- 2,1040-3. In some embodiments, the cluster master 1020 manages theconfiguration of the indexers 1040-1, 1040-2:, 1040-3 and orchestratesremedial activities if an Indexer 1040-1, 1040- 2, or 1040-3 goesoffline or fails. For example, the cluster master 1020 may inform eachIndexer 1040-1, 1040-2, 1040-3 which of the other indexers 1040-1,1040-2, or 1040-3 to stream its data to. In some embodiments, after thecluster master 1020 has informed each of the indexers 1040-1, 1040-2,1040-3 which of the other indexers to stream to, the indexers 1040-11040-2, 1040-3 exchange data with: each other without Involvement of thecluster master 1020, unless one or more indexers go down. In someembodiments, the cluster master 1020 resides on a different machine orvirtual machine than that which the Indexers 1040-1, 1040-2, 1040-3 orsearch head 2030 reside.

Forwarders 1050-1, 1050-2 consume data from external sources and forwardthe data to an Indexer 1040-1, 1040-2, 1040-3. For example, theforwarders 1050-1, 1050-2 may receive data from one or more client orcustomer machines, and may forward the received data to one or more ofthe indexers 1040-1,1040-2,1040-3.

In some embodiments, the number of indexers that are included in acluster depends on an indexing load and a cluster replication factor.Indexing load refers to an amount of data that needs to be Indexed for agiven client or customer. For example, if an indexing load is more thanthree indexers can handle, more indexers may be added to increasecapacity.

As used herein, a “replication factor” is the number of copies of anygiven data that are to be stored in a cluster. A client or customer mayspecify the number of copies of data that the client wants the clusterto maintain as part of configuring the cluster master 1020. For example,a client or customer may indicate that they want to store three copiesof customer data, which corresponds to a replication factor of three. Areplication factor of three requires at least three indexers. Thereplication factor determines the cluster's failure tolerance, and isalso used to determine index replication. A cluster can tolerate afailure of (replication factor-1.) indexers 1040-1, 1040-2, 1040-3. Forexample, if the system 1000 needs to be configured to handle the failureof two of the indexers 1040-1, 1040-2, 1040-3, then a replication factorof three must be configured. A replication factor of three indicatesthat the cluster 1010 stores three identical copies of a client's dataon separate indexers 1040-1, 1040-2, 1040-3. As a result if two of theindexers 1040-1, 1040-2, or 1040-3 go down or are otherwise inoperable,the data is still available on a third of the Indexers 1040-1, 1040-2,or 1040-3.

In some embodiments, if the cluster 1010 is configured with areplication factor of three, one of the Indexers 1040-1, 1040-2, 1040-3may receive data from a forwarder. The Indexer may process the data andthen stream the date to the two other indexers 1040-1, 1040-2, or1040-3. Accordingly, the cluster 1010 will contain three complete copiesof the data. In some embodiments, all three indexers 1040-1, 1040-2,1040-3 receive external data from a forwarder 1050-1 or 1050-2 and alsoreceive replicated data from each of the other indexers 1040-1, 1040- 2,or 1040-3. In some embodiments, the data stored according to areplication factor Is stored as non-searchable copies.

Furthermore, a search factor may be used to determine the number ofsearchable copies of data that the cluster 1010 maintains. The searchfactor correlates to how quickly the cluster can recover its searchingcapability after an Indexer goes down. A client or customer may specifythe search factor as part of configuring the cluster master 1020. Forexample, a search factor value of two allows the cluster 1020 tocontinue searches with little interruption if a single indexer goesdown. The difference between a searchable and a non-searchable copy ofsome data is that the searchable copy contains both the data itself andone or more index files that may be used to search the data. Thenon-searchable copy contains only the data. In some embodiments, thedata stored in the non-searchable copy may undergo initial processingand may be stored in a form that makes it possible to recreate the indexfiles later. Without a search factor of at least one, there may be asignificant lag before searching can resume if an indexer goes down. Insome embodiments, the cluster master 1020 keeps track of the indexers1040-1, 1040-2, 1040-3 that have searchable data and ensures that thereare always a search factor number of copies of searchable dataavailable.

FIG. 2 shows a block diagram of an embodiment of a data managementsystem 2000. In some embodiments, the data management system 2000 may bepart of the cluster 1010 illustrated in FIG. 1. In some embodiments, thedata management system 2000 may be part of one of the indexers 1040-1,1040-2, or 1040-3 Illustrated in FIG. 1. The data management system 2000may be used by a service provider to provide a service for storing,indexing, and searching data for one or more clients or customers.

Data intake 2010 receives data, e.g., from a data provider, customer,client, or other user. The data can include automatically collected,data, data uploaded by users, or data provided by the data providerdirectly. In some embodiments, the data may be received from one or moreforwarders. In some embodiments, the data includes a structure thatallows for individual events and field values within the events to beeasily identified. The structure can be predefined and/or identifiedwithin the data. For example, various strings or characters can separateand/or identify fields. As another example, field values can be arrangedwithin a multi-dimensional structure, such as a table. In someinstances, data partly or completely lacks an explicit structure. Forexample, in some instances, no structure for the data is present whenthe data is received and instead is generated later. The data mayinclude a continuous data stream that can include multiple events, eachwith multiple field values.

A schema engine 2030 identifies an applicable schema that can be used toextract specific field values by imposing structure on data.Specifically, & schema can be “bound” to data by breaking a data stream(e.g., a byte stream) into events and/or extracting field values, suchas a time stamp. Schema binding can occur while receiving data, prior tostoring data, while storing data, while processing data, whileretrieving data, while responding to a search query or some combination:of the above (e.g., separating data into events at intake and extractingfield values from events while responding to a search query). Latebinding schema can be used, which imposes structure on the data at querytime rather than at storage or ingestion time.

Schema engine 2030 can itself estimate a schema or can determine aschema based on input: from a client, customer, or data provider. Theinput can include the entire schema or restrictions or identificationsthat can fee used to estimate or determine a full schema. Such input canbe received to identify a schema for use either with structured orunstructured data and can be used to reliably extract field values. Theschema can be estimated based on patterns In the data (e g., patterns ofcharacters or breaks in the data or headers or tags identifying variousfields in the data, such as <event><message time>2014.01.05,08,59.59</>. . . </>), Schema can be received or estimated In a variety times,including (in some embodiments) any time between receipt or indexing ofthe data and at query time. The time that the schema is actuallyreceived or estimated within the receipt-to-indexing time period may bedetermined based on a setting or system load. Schema engine 2030 canperform the schema estimation once or multiple times (e.g., continuouslyor at routine intervals). Once a schema is determined, if can bemodified (e.g., periodically, at regular times or intervals, uponreceiving modification-requesting input, upon detecting a new or changedpattern in the input, or upon detecting suspicious extracted fieldvalues (e.g., being of an inconsistent data type, such as stringsinstead of previously extracted integers)). In some embodiments, aclient customer, or data provider can provide input indicating asatisfaction with or correction to estimated schema. Received orestimated schemas are stored In a schema data store 2040.

Using the schema, an event parser 2020 can separate the received dataInto events. For example, event, parser 2020 can separate data betweenparticular start and stop tags, or separate data within a table's row,or separate data within particular character numbers in the data. Alsousing the schema, a field extractor 2050 can extract various fieldvalues. In some embodiments, field extractor 2050 further attaches asemantic meaning to the extracted field values (e.g., based on a lengthand/or character types of the field values). Field extractor 2050 canfurther convert field values into a particular (e.g., standard or easilysearchable) format.

A storage engine 2060 can store data in an event data store 2070. Itwill be appreciated that event data store 2070 can Include multiple datastores or sub-data stores Event data store 2070 can be stored inworking, short-term, and/or long-term memory. In various embodiments,event data store 2070 can include raw data, extracted events, orextracted field values. It will be appreciated that, in someembodiments, part of the data received by data Intake 2010 can bedeleted or not stored (e.g., field breaks).

Events and/or field values can be stored at locations based on a fieldvalue. For example, a field value identifying a message sender may bestored in one of ten data stores, the data store being chosen based on amessage time. In some instances, rather than grouping various datacomponents at specific storage areas, event data store 2070 includes anindex that tracks identifiers of events and/or fields and identifiers offield values. Thus, for example, the index can include an element, for“Data type”=“webpage request” (indicating that the element refers to afield value of “webpage request” for the field “data type”) and thenlist identifiers for events with the field value (e.g. “Events 3, 7, 9and 16”). Selective storage grouping can be referred to as storing datain “buckets.” Bucket definitions can be fixed or defined based on inputfrom a data provider, customer, or client. Input and/or automatic rulescan be used to add, merge, or delete buckets.

In some instances, a time-series data store is used, such that eventsand/or field values are stored at locations based on a timestampextracted from the events. This can allow events with recent timestamps(e.g., which may have a higher likelihood of being accessed) to bestored at preferable memory locations that lend to quicker subsequentretrieval. Further, parallel processing can then be performed, with eachprocess operating on a different time bucket.

A search engine 2080 can subsequently access and search ail or part ofevent data store 2070. The search can be performed upon receiving asearch query from a client, user, customer, or other user-, or thesearch can be performed periodically and/or at defined intervals ortimes. In some embodiments, a search query may be received by the searchhead 1030 illustrated in FIG. 1. and provided to the search engine 2080.In some embodiments, the search engine 2080 may be part of the: searchhead 1030. Segregation of data Into events and/or fields can allow formore efficient searching. The search may include, for example, a requestto return all events or identifiers of all events having a value for afield meeting a criterion. To illustrate, search engine 2080 canretrieve all events having a timestamp within a defined time period, orall events having a first field value (e.g., HTTP method) set to aspecified value (e.g., GET).

The search may include, for example, a request to return values for oneor more first fields for all events having specified values (e.g.,specific values or values within a specific range) for one or moresecond fields. To illustrate, search engine 2080 can retrieve all URLsin events having a timestamp within a defined time period, or all eventshaving a first field value (e.g., HTTP method) set to a specified value(e.g., GET).

In some embodiments, upon retrieving the: event data of interest, searchengine 2080 may further process the results. The processing may beperformed based on an individual value (e,g., to obtain a length ordetermine if an extracted field value matches a specified value). Insome embodiments, processing may be performed across values. Forexample, the processing may be, performed to determine an average,frequency, count, or other statistic. Search engine 2080 can return thesearch result to the client, customer, or user. For example, the searchresult may be returned using an interface (such as a web interface orother graphical interface), email, or the like. In some embodiments, thesearch engine 2080 may include the search head 1030 illustrated in FIG.1.

FIG. 3 illustrates a flowchart of an embodiment of a process 3000 forstoring and using big data. Process 3000 begins at block 3010, wheredata intake 2010 receives data. Schema engine 2030 identifies anapplicable schema at block 3020. Event parser 2020 applies the schema toseparate the data into events at block 3030. Field extractor 2050applies the schema to extract field values from the events at block3040. Storage engine 2060 stores raw data events and/or field values Inevent data store 2070 (e.g., by assigning the data, events and/or fieldvalues to buckets based on particular field values) at block 3050.

Search engine 2080 receives a search query from a searcher (e.g.,client, customer, or user) at block 3060. The search query can includeone or more criteria which can specify or constrain field values. Searchengine 2080 searches event data store 2070 at block 3070. In someembodiments, the search may entail searching only some of event datastore 2070 (e.g., that including field values of interest). The searchcan produce identifiers of events of interest.

Search engine 2080 may then collect other field values for those eventsof interest. A search result can Include the collected other fieldvalues and/or a processed version thereof. Search engine 2080 returnsthe search result to the searcher at block 3080.

It will be appreciated that system 2000 and/or process 3000 may bemodified such that schema is not bound to data (or only a portion of theschema is bound to data) immediately following intake. For example,schema could instead be bound to prior to storage of the data, duringstorage of the data, or at a query time (e.g., subsequent to block 3060of process 400). Splunk Enterprise produced by Splunk Inc. of SanFrancisco is an exemplary system for creating a time series data storeusing a late binding schema. For example, Splunk Enterprise creates atime senes data store by segmenting received raw data into events,extracting timestamps from each event, and storing each event in one ormore time series data stores that are searchable by timestamp (alongwith other metadata such as source, type, and the, like). SplunkEnterprise allows later schema development of fields any time up toquery time.

In some embodiments, data management system 2000 and/or process 3000 maybe modified to include features, feature connections, and/or flows asdescribed in Carasso, David. Exploring Splunk Search Processing Language(SPL) Primer and Cookbook. New York: CITO Research, 2012 and/or asdescribed in Ledion Bitincka, Archana Ganapathi, Stephen Sorkin, andSteve Zhang. Optimizing data analysis with a semi-structured time seriesdatabase. SLAML, 2010. Each of these references is hereby incorporatedby reference in its entirety for all purposes.

In some embodiments, the data received by data intake 2010 include, forexample:

-   -   Log data: types of data access attempts, times of data access        attempts, users attempting access, access successes, subsequent        user behaviors (e.g., subsequently accessed data or access        reattempts), error occurrences, warning occurrences, serving        resources    -   Message data (e.g., email data): sender identifiers, recipient        identifiers, transmission times, subject lines, message sizes,        message formats, message contents    -   Media data: identifiers of movie, picture or sound files; values        In files; size of flies; entity that uploaded or owns the fifes;        file types; keywords    -   Sensor data (e.g., light sensor, motion sensor, accelerometer):        sensor identifiers, sensor locations, sensor values    -   User activity data (e.g., web-access data): web-page        identifiers, user identifiers, locations of users, IP addresses        of users, devices used by users via access, sequences of page        access, access durations, information entered via web pages    -   Social-network data: Identifiers of users connected to each        other, types of connections, times of connection initiation    -   Inventory data: identifiers of products, product prices,        inventory remaining, inventory sold, sale locations, sale        prices, profits, manufacturer Identifiers    -   Economic-data (e.g., stock data, home-sale data): buyer        identifiers, purchase times, identifiers of purchased commodity,        seller identifiers, location of purchased commodity (if        applicable)    -   Employment data: employer identifiers, employee identifiers,        employment locations, position types, hire times, termination        times, promotion times, promotion types, connections between        employees (e,g., between supervisors and supervised employees),        salaries    -   Medical data (e.g., MRI data, EEG data, medical records):        patient identifiers, test identifiers, test data, analysis data    -   Genomic data: species Identifiers, genes, intra-species        reliability, nucleotides, gene identifiers, behavior or disease        couplings (e.g., identifying a set of nucleotides being part of        gene which is linked: to a particular disease)    -   Search data; search occurrence, search terms, search        constraints, users conducting searches, databases searched,        results returned, results selected by (e.g., clicked on) by        users    -   Call data: phone number and/or user initiating calls, phone        number and/or user receiving calls, whether calls were answered,        time of call initiations, duration of calls    -   Electrical data (e.g., electricity usage): user identifiers,        times of usage, amounts of usage, sources of electricity used        (e,g., coal, natural gas, nuclear, solar, wind, etc.)    -   Neuroscience data (e,g,s recordings from neurons): times of        recordings, recording values, cell identifiers, amplification        settings, users owning recordings

As implied from the above examples, data stored and/or used can includea plurality of events (or entries), each of which can include values forparticular fields. For example, in the “message data” instance, eachevent can correspond to a message, and each event can include a valuefor each of the following fields: sender, recipient, message time,subject, message size, message format, and message content.

FIG. 4 shows a block diagram of an embodiment of a system 4000implemented in a hosted computing environment. In some embodiments, thehosted computing environment includes a cloud computing network. Thehosted computing environment allows the network resources to be sharedby multiple clients or customers. The resources may be dynamicallyre-allocated as the demand from different users changes In someembodiments, the hosted computing environment is a virtual private cloud(VPC). A VPC is a virtual network dedicated to a particular user accountand is logically isolated from other virtual networks in the networkprovider's cloud. Different services may be launched on a VPC. Forexample, the system 4000 may be implemented on a VPC and may provide aservice for collection, analysis, indexing, and secure storage of datainto a data store or data source. A client or customer may use theservice to store, index, and/or search the customer's data. The clientor customer may configure the VPC, including selecting an internetprotocol (IP) address range for different components of the network,create subnets, and configure route tables, network gateways, andsecurity settings. In some embodiments, the hosted computing environmentis a public cloud network, in which the network is open for public use.

The system 4000 includes a cluster 4010 with public subnet 4020 andprivate subnets 4030-1, 4030-2, 4030-3. The cluster 4010 may operatesimilarly to the cluster 1010 illustrated in FIG. 1, and may provideindexing, storing, and searching of data for clients or customers. Asubnet is a range of IP addresses in the hosted computing environmentthat provides a logical grouping of connected network devices. In someembodiments, a public subnet may be used for resources that are to beconnected directly to the Internet, and a private subnet may be used forresources that will not be directly connected to the Internet. Serviceresources may be launched into a selected subnet. A service resource maybe referred to as an “instance” after the resource has been launchedinto a subnet and provided with an IP address In the address range ofthe subnet. For example, public subnet 4020 includes various instances,such as a search head elastic load balancer (ELB) 4040, an Indexer ELB4050, and a firewall 4060. Each of the instances in the public subnet4020 includes an external IF address. For example, each of the publicsubnet 4020 instances may include either an elastic IP address (EIP) oran ELB address.

The private subnets also include various Instances that are launchedinto each subnet. Private subnet 4030-4 includes Indexer 1 4070-1 andsearch head 4080, private subnet 4030-2 includes license master 4090 andindexer 2 4070-2, and private subnet 4030-3 includes cluster master 4100and indexer 3 4070-3. The cluster master 4100, the search head 4080, andthe indexers 4070-1, 4070-2, 4070-3 may perform similar functions as thecluster master 1020, search head 1030, and indexers 1040-1, 1040-2,1040-3 described above with respect to FIG. 1.

Each of the Instances in the private subnets may connect out to thehosted services 4112 (vis network 4110) using the firewall 4060 in thepublic subnet 4020. Further, the instances in the private subnets do nothave EIPs. Rather, an ELB may be used to make the private subnetinstances available to the Internet. For example, the search head ELB4040 may be used to provide Internet connectivity to the search head4080, and the indexer ELB 4050 may be used to provide Internetconnectivity to the indexers 4070-1, 4070-2, and 4070-3.

One or more customers 4120 may provide data to be indexed and/or mayaccess the data stored In Indexers 4070-1, 4070-2, and 4070-3 vianetwork 4118. The indexers 4070-1, 4070-2, 4070-3 receive and indexincoming raw data from clients or customers 4120 via indexer ELB 4050.Based on a replication factor specified by a client or customer, each ofthe Indexers 4070-1, 4070-2, 4070-3 may send replicated data to otherindexers 4070-1, 4070-2, 4070-3 in the cluster 4010 and may receivereplicated data from other Indexers 4070-1, 4070-2, 4070-3. In someembodiments, an Indexer 4070-1, 4070-2, or 4070-3 may index receiveddata and simultaneously receive and send replicated data to otherindexers. The indexers 4070-1, 4070-2, 4070-3 search across theirIndexed data in response to search requests received from the searchhead 4080 via search head ELB 4040. In some embodiments, the indexer ELB4050 may load balance incoming data equally across each of the indexers4070-1, 4070-2, and 4070-3. In some embodiments, if any one of theindexers 4070-1, 4070-2, and 4070-3 goes down or is inoperable, theindexer ELB 4050 may not provide any data to that subnet.

The search head 4080 receives search queries, via search head ELB 4040,from clients or customers 4120 requesting a search of client data. Thesearch head 4080 may coordinate and manage searches across the set ofindexers 4070-1, 4070-2, 4070-3. The cluster master 4100 informs thesearch head 4080 of the indexers that are to be used by the search head4080. The search head 4080 distributes search queries to the indexers4070-1, 4070-2, 4070-3, and receives search results from each indexer.The search head 4080 may then consolidate the results returned by theindexers, and may return the consolidated results to the client orcustomer using the search head ELB 4040.

The cluster master 4100 provides management functions for the cluster.For example, the cluster master 4100 coordinates the replicatingactivities of the indexers 4070-1, 4070-2, 4070-3 based on the specifiedreplication factor. The cluster master 4100 may direct the search head4080 where to find data among the indexers 4070-1, 4070-2, 4070-3. Insome embodiments, the cluster master 4100 manages the configuration ofthe indexers 4070-1, 4070-2, 4070-3 and orchestrates remedial activitiesif an indexer 4070-1, 4070-2, 4070-3 goes offline or becomes inoperable.The license master 4090 manages the license for a specific stack withinthe cluster 4010.

When a client or customer desires to have a service operate on a hostedcomputing environment, the hosted computing environment must beprovisioned so that the various components of the environment areconfigured for network operation using the service resources. Forexample, the known service resources that the customer desires to haveaccess to must be mapped to cloud services and components that will runthe services. In some embodiments, the service resources include thesearch head 4080, cluster master 4100, and the indexers 4070-1, 4070-2,4070-3, which must be mapped to various cloud network components. Buildservers 4116 may be used to provision and configure the cluster 4010 tooperate the desired service. For example, the build servers 4116 mayinclude a provisioning program, such as a Jenkins or Chef Tool. Jenkinsand Chef are open source DevOps tools that may be used to configure theservices on the hosted computing environment. A server or other machineor virtual machine running an instance of a provisioning program mayoffer an overview of the build status for projects that were configuredto be built on the server or machine.

Commands are provided to the build servers 4116 that describe theservice resources that are to be provided and the particular state thatthe resources should be in. For example, the commands may describepackages that should be installed, services that should be running,and/or files that should be written. Using these commands, the buildservers 4116 make sure each resource is properly configured. Thecommands used to provision the hosted computing environment are complexand require technical knowledge of an underlying programming language.The commands may be included in a provisioning template that specifiesthe configuration of the hosted computing environment to the buildservers 4116. In some embodiments, the provisioning template may be aconfiguration file. An exemplary provisioning template is illustrated inFIG. 10, and will be discussed In further detail below. Some clients,customers, or other users may not have the technical knowledge relatingto the commands that is required to configure the environment. Systemsand methods disclosed herein provide these types of clients, customers,and users with the ability to provision a hosted computing environmentwithout requiring, them to possess the underlying programming knowledge.

FIG. 5 shows a block diagram of an embodiment of a build system 5000 forprovisioning and configuring a hosted computing environment, such as thehosted computing environment illustrated in FIG. 4. The build system5000 includes a graphical interface, engine 5020 that generatesgraphical Interfaces that may be used by clients, customers, or otherusers. Exemplary graphical interfaces will be described below withrespect to FIGS. 6 and 7. A client, customer, or other user may indicateone or more requirements for the service implemented: on the hostedcomputing environment by providing one or more inputs into a graphicalinterface. For example, a user may provide input indicating an amount ofstorage they wish to have access to in the hosted computing environment.In some embodiments, the user may use a service that stores and/orindexes in the storage a set of event, records that include unstructuredmachine data. The client, customer, or other user may indicate how muchstorage they need per day. In some embodiments, the client, customer, oruser may provide Input indicating a client, customer, or user name. Inanother example, a user may provide input indicating an amount ofstorage, a customer name, a number of search heads, a number ofindexers, a replication factor, and/or a search factor.

The graphical interface engine 5020 receives the input corresponding tothe indication of the one or more requirements for the service. Thegraphical interface engine 5020 may forward the input to the buildengine 5010. The build engine 5010 receives the input and converts eachindication of the one or more requirements into one or more entries of aprovisioning template. The provisioning template includes multipleentries and is associated with the hosted computing environment. Theinput provided by the user is used by the build engine 5010 to populatethe entries of the provisioning template that relate to the inputinformation. For example, an entry in a provisioning template may relateto an amount of storage that a user will have access to per day. In thisexample, the build engine 5010 may receive Input from the user relatingto their storage requirements, and may convert the Input into thecorresponding entry in the provisioning template that relates to theamount of storage. In some embodiments, the conversion of eachindication of the requirements into the entries of the provisioningtemplate includes encoding fields entered by the user in the graphicalinterface into the entries.

Depending on the input provided by the client, customer, or other user,remaining entries of the provisioning template may need to be populatedin order to generate a complete provisioning template. For example, insome embodiments, the user may enter enough information into thegraphical Interface so that a complete provisioning template may begenerated. In other embodiments, the user may not enter enoughinformation into the graphical interface to allow a completeprovisioning template to be generated.

If the user does not enter enough information into the graphicalinterface so that a complete provisioning template can be generated, thebuild engine 5010 determines additional requirements of the hostedcomputing environment according to the input received from the user. Thedetermined additional requirements may be used to populate the remainingadditional entries of the provisioning template. The determinedrequirements may include an amount of storage, a number of search heads,a number of indexers, a replication factor, a search factor, a licensemaster, or a cluster master. The determination of the requirements maybe a rules based determination. For example, the user may input anamount of storage per day that they require of the service that is to berun on the hosted computing environment. In response to receiving theinput, the additional requirements determined by the build engine 5010may include certain configuration requirements of the hosted computingenvironment that are needed to host the service according the user'srequired storage amount. For example, the additional requirements mayinclude whether a cluster master or license master is required and/or aspecific number of search heads, indexers, or forwarders. As a specificexample, a user may input a storage requirement of 50 GB/day. Inresponse, the build engine 5010 may determine, based on a given rule,that the Input requirement of 50 GB/day translates into additionalrequirements of one search head, one indexer, no cluster masters, and acloud provider instance size of extra large (corresponding to the GPU,memory, storage, and networking capacity of the cloud providerinstance).

After the build engine 5010 determines the additional requirementsneeded to make the service functional In the environment according tothe received input, the build engine 5010 populates one or moreadditional entries of the provisioning template with the determinedadditional requirements to provide a complete provisioning template.

The build engine 5010 may provide the completed provisioning template toa provisioning program to provision the hosted computing environment. Insome embodiments, the provisioning template may be implemented by one ormore of the build servers 4116 Illustrated in FIG. 4. In someembodiments, the provisioning template may be implemented by the buildengine 5010.

The provisioning program may map the provisioning template to one ormore components and/or services of the hosted computing environment toprovision the components to operate the desired service. By mapping theprovisioning template to the components of the hosted computingenvironment, the components in the hosted computing environment areprovisioned so that the components are configured for network operationusing the service resources that are described in the provisioningtemplate. The service resources include, for example, one or more searchheads, a cluster master, a license master, one or more indexers, areplication factor, and/or a search factor. The entries in theprovisioning template corresponding to a resource are mapped to thevarious hosted computing environment components.

Hosted computing environment component requirements may be determinedusing information stored in one or more databases, such as database5030. The databases (e.g., database 5030) may include information aboutthe various hosted computing environment platforms, operating system(e.g., Linux) libraries and tools, functional tests, and performancetests. For example, the database 5030 may include information requiredto map various virtual machine nodes of the hosted computing environmentprovider to provider independent node definitions (e.g., an specificnetwork provider node may be mapped to a node with 8 GB of RAM, 4 coresand 840 GB of disk space).

The database 5030 may also include information needed to map objectsrelating to the provider of the service that are desired by the user(service provider objects) to one or more provider independent nodes orcomponents. The service provider objects may include, for example, acluster master, license master, a search head, one or more indexers, oneor more forwarders, and/or the like For example, a search head with thecapability of 50 concurrent searches maps to a provider independent nodewith 16 cores and 60 GB of RAM.

Other information that may be stored in the database 5030 may include alist of all dependencies needed to install a service provider role on agiven operating system, service provider binaries, an ordering in whichthe service provider objects need to be brought up (e,g., a clustermaster may need to be brought up for service before an indexer), a listof functional tests, and a list of performance tests. The database 5030may also store information needed to map performance tests to businessgoals. For example, a first test may test that the system can do 50concurrent searches, and a second test may test that the system canindex 100 68/day.

The hosted computing environment components may be cloud components thatare cloud platform independent. The components In the hosted computingenvironment may include, for example, physical machines, physicalservers, virtual machines, virtual servers, and the like. For example,an entry in the provisioning template may map to a virtual machine withfour cores and 8 GB of RAM. For different cloud platforms, the virtualmachine may correspond to different types of instances that are specificto that cloud platform provider. If exact matches are not available,most appropriate alternative may be selected.

After the hosted computing environment is provisioned using theprovisioning template, the build system 5000 then configures thecomponents of the hosted computing environment by bringing up all of thenetwork components in parallel and configuring the networking, DNS,hostname, and the like. The build system 5000 also creates and maintainsa list of dependencies needed to bring up a proper configuration for agiven component role. For example a component In a web server role mightneed php libraries. After all the network components are up, each of thecomponents are configured for a given role in parallel. For example, alllibraries and dependencies are fetched from private or publicrepositories (e.g., database 5030) and installed/deployed oncorresponding components.

The build system 5000 then installs all of the software components ofthe service in the hosted computing environment components. The softwarecomponents are: then configured as indicated by the provisioningtemplate (e.g., with specified index replication, search factor, etc.).The build system 5000 brings up all of the service software componentsin the proper order to create a cluster (e.g., cluster 4010). Forexample, a cluster master might be brought up first, followed by asearch head and the indexers. In some embodiments, the build system mayexecute one or more tests to verify the functionality of the clustersystem. If all tests pass, the system is declared functional and readyfor any performance testing that may be performed.

Accordingly, the system 5000 allows a client, customer, or other user togenerate a complete provisioning template while only being required toknow high level details about their desired service (e.g., an amount ofstorage). For example, a user may enter information as simple as anamount of storage needed to Index or store their data, and aprovisioning template may be generated and used to provision the hostedcomputing environment to run a service according to their requirements.

Different graphical interfaces and systems may be generated andimplemented to accommodate different types of users. For example, usersof the provisioning system 5000 may include a business user (e.g., anon-technical sales person), a sates engineer, and/or anengineering/operations professional. Different types of users will havevarying sophistication levels with regard to the commands needed toprovision the hosted computing environment. Accordingly, each differentuser may have a different level of engagement with the system and mayuse a different type of graphical interface.

FIG. 6 illustrates an exemplary embodiment of a graphical interface6000. The graphical interface allows a client, customer, or other userto provide an input indicating one or more requirements for a serviceimplemented on the hosted computing environment. The graphical interface6000 may be designed for use by an unsophisticated user of a service.For example, a business user may not have any knowledge as to thetechnical details of the service being provided to a customer, such ashow many cluster masters, search heads, indexers, and/or forwarders areneeded to meet the requirements of the customer. Accordingly, the usermay only need to enter the amount of storage that the customer requiresfor their use of the service. The user may also enter a customer name inorder to differentiate the customer from other customers of the serviceprovider.

The user may enter the customer name in input area 6010 and may enterthe storage requirements of the customer in input area 6020. Input areas6010 and 6020 may include any type of input, such as a text input box, adrop-down input, a list of inputs, or the like. The storage requirementsentered into input area 6020 indicate an amount of storage the customerrequires in the hosted computing environment. In some embodiments, theuser may indicate In input area 6020 how much storage they require perday. The graphical interface engine 5020 receives the inputs fromgraphical interface 6000 and forwards the inputs to the build engine5010. The build engine then performs the functions described above withrespect to FIG. 5 for provisioning and configuring the hosted computingenvironment.

FIG. 7 illustrates another exemplary embodiment of a graphical interface7000. The graphical interface 7000 may be designed for use by a moresophisticated user of a service than a user of graphical interface 6000.For example, a user that—knows technical details of the, service beingoffered by the service provider may use graphical interface 7000. If theservice relates to those offered by a system similar to that illustratedin FIG. 4, the user may indicate specific requirements of the systemneeded to implement a customer's needs. For example, using graphicalinterface 7000, a user may provide input indicating an amount ofstorage, a customer name, a number of search heads, a number ofindexers, a replication factor, and/or a search factor. The user mayenter the customer name in input area 7010, the customer storagerequirements in input area 7020, a number of search heads in input area7030, a number of indexers in Input area 7040, a replication factor ininput area 7050, and a search factor in input area 7060. Input areas7010-7060 may include any type of input, such as a text Input box, adrop-down input, a list of inputs, or the like. The graphical interfaceengine 5020 receives the inputs from graphical interface 7000 andforwards the Inputs to the build engine 5010. The build engine thenperforms the functions described above with respect to FIG. 5 forprovisioning and configuring the hosted computing environment.

In some embodiments, a graphical interface may present a graphicalrepresentation of various options that a client, customer, or other usermay choose for the configuration of the service on the hosted computingenvironment. For example, when a user is presented with a graphicalinterface, a graphical representation may be displayed for the user tovisualize the options that may be selected. The user may then selectfrom a list of options presented in the graphical representationdisplayed in the graphical interface. The options may be pre-selectedand generated by the service provider (e.g., an engineer, softwaredeveloper, and the like) for presentation to the user based on thegeneral architecture of the resulting system and business requirements(e.g., type of service being offered, type of business the customer isInvolved in, and the like). In some embodiments, the options may Includeall hosted computing environment services, components, and connectionsthat are available for configuring the network. After a user hasselected one or more options, the graphical interface engine 5020receives the one or more Inputs from the graphical interface andforwards the one or more input to the build engine 5010. The buildengine then performs the functions described above with respect to FIG.5 for provisioning and configuring the hosted computing environment.

Some users (e.g., an engineering/operations professional) may knowenough about provisioning that they can use a configuration file toprovide all inputs to the system. For example, the user may create aprovisioning template by writing a JSON configuration file, which mayprovide all of the necessary inputs to configure the hosted computingenvironment. For example, an experienced user may use a configurationfile to provide the following inputs to create a provisioning template:

Compute

The compute section establishes instances in the hosted computingenvironment. The values below are placed in an array. The followingvalues are supported for each array element under the compute label;

Value Default Description Hostname identifier for the provisionedinstance (alphanumeric and underscores, unique per stack) instance_typeml .small Size of instance (e.g., in Amazon style as ml.large) roleTop-level run-list entry defining instance configuration cluster idNumeric identifier of cluster membership dnsalias int. none Array of DNSalias names for host-discovery by other nodes dnsalias_pub none Array ofDNS aliases for public access (beyond stack) reprov1s1on allowProtection against automatic instance destruction: allow, neversecurity_groups Array of TBD network security- group names storage noneArray of block-storage definitions Tags Stack, Role List of tags (key =val) to apply at cloud-provider level Zone 1 Availability zone (indexinto the regions JSON object, see below)

Storage

Storage attachments can be defined with the following settings:

Value Default Description size 10 Gigabytes to allocate element Elementnumber within a device device Name of device to which this elementbelongs iops 2000 Performance requested (non-sequential I/O operationsper second) tags none Key/value pairs volumetype standard Storage type -ephemeral, standard, io 1, ssd zone (instance zone) Availability zone,from regions definitions

Security Groups

Security groups are defined as follows:

Keyword Value name Group name description Text description rules Arrayof rules, as below

Security Rules

Keyword Value ip_protocol icmp, tcp or udp direction inbound (outboundisn't supported) range port number number or range 0 through 65535source IPv4 address block, in CIDR notation n.n.n.n.n/m group name ofanother security group

Availability Zones

Availability zones are defined as a separate JSON object:

Value Default Description am1 TBD Default base image region Region, e.g.us-east-1 or us-west-1 zone Zone identifier, e.g. us-east-1c

FIG. 8 illustrates a flowchart of an embodiment of a process 8000 forprovisioning a hosted computing environment with services. In someembodiments, process 8000 may be implemented by build system 5000 inorder to provision and configure the hosted computing environmentillustrated in FIG. 4. Process 8000 begins at block 8010 by generating agraphical interface on a computing device. For example, the graphicalinterface engine 5020 may generate the graphical interface.

At block 8020, the process 8000 continues by receiving inputcorresponding to an Indication of one or more requirements, wherein theinput is received using the graphical interface, and wherein the one ormore requirements correspond to a hosted computing environment. In someembodiments, the indication of the one or more requirements Includes anamount of storage. In some embodiments, the indication of the one ormore requirements includes an amount of storage per day. The storage maybe a time series data store used for storing a set of event records thatinclude unstructured machine data. The time series data store may storedata that is segmented into a set of lime stamped events, in someembodiments, the Indication of the one or more requirements furtherincludes a customer name. For example, a user may use graphicalinterface 6000 to input customer storage requirements and customer name.In some embodiments, the indication of the one or more requirementsincludes an amount of storage, a customer name, a number of searchheads, a number of indexers, a replication factor, or a search factor.For example, a user may use graphical interface 7000 to input one ormore of the various customer requirements.

The process 8000 continues at block 8030 by converting each indicationof the one or more requirements Into one or more entries of aprovisioning template, wherein the provisioning template includesmultiple entries, and wherein the provisioning template is associatedwith the hosted computing environment. The provisioning template definesa configuration of the hosted computing environment. For example, thebuild engine 5010 may convert: inputs received from the graphicalInterface engine 5020 into one or more entries of the provisioningtemplate. In some embodiments, the user may enter enough informationinto the graphical interface so that a complete provisioning templatemay be generated.

If a complete provisioning template can be generated based on thereceived input, the process 8000 continues to block 8040 and providesthe provisioning template to a provisioning program to provision thehosted computing environment. In some embodiments, the provisioningprogram includes an open source provisioning program. For example, theprovisioning program may include a Jenkins or a Chef tool, as describedabove.

FIG. 9 illustrates a flowchart of another embodiment of a process 9000for provisioning a hosted computing environment with services. In someembodiments, process 9000 may be implemented by build system 5000 inorder to provision and configure the hosted computing environmentIllustrated in FIG. 4. Process 9000 may be implemented when a user doesnot enter enough information in the graphical Interface so that acomplete provisioning template may be generated. Process 9000 begins atblock 9010 by generating a graphical interface on a computing device.The graphical interface engine 5020 may generate the graphicalInterface.

At block 9020, the process 9000: continues by receiving inputcorresponding to an indication of one or more requirements, wherein theinput is received using the graphical interface, and wherein the one ormore requirements correspond to a hosted computing environment. In someembodiments, the indication of the one or more requirements includes anamount of storage. The indication of the amount of storage may includean amount of storage per day. The indication of the one or morerequirements may further include a customer name. For example, a: usermay use graphical interface 6000 to input customer storage requirementsand customer name. In some embodiments, the indication of the one ormore requirements includes an amount of storage, a customer name, anumber of search heads, a number of indexers, a replication factor, or asearch factor. For example, a user may; use graphical interface 7000 toinput one or more of the various customer; requirements.

The process 9000 continues at black 9030 by converting each indicationof the one or more requirements into one or more entries of aprovisioning template, wherein the provisioning template includesmultiple entries, and wherein the provisioning template is associatedwith the hosted computing environment. The provisioning template definesa configuration of the hosted computing environment. For example, thebuild engine 5010 may convert inputs received from the graphicalinterface engine 5020 into one or more entries of the provisioningtemplate.

In some embodiments, the user may not enter enough information into thegraphical interface to allow a complete provisioning template to begenerated. As a result, the process 9000 continues at block 9040 bydetermining additional requirements of the hosted computing environmentaccording to the input received using the graphical interface. Forexample, the build engine 5010 may determine the additional requirementsbased on the received input. The determined additional requirements maybe used to populate the remaining additional entries of the provisioningtemplate. The determined requirements may include an amount of storage,a number of search heads, a number of indexers, a replication factor, asearch factor, a license master, and/or a cluster master. In someembodiments, the determination of the additional requirements may be arules based determination, as described above with respect to FIG. 5.For example, the input indicating one or more requirements Includes anamount of storage, and the additional requirements include a number ofsearch heads, a number of indexers, a replication factor, a searchfactor, or a cluster master based oh a rule for the indicated amount ofstorage.

At block 9050, the process 9000 continues by populating one or moreadditional entries of the provisioning template with the determinedadditional requirements. For example, the build engine 5010 may populateone or more additional entries of the provisioning template with thedetermined additional requirements to provide a complete provisioningtemplate. In some embodiments, any other remaining entries of theprovisioning template may be populated based on rules (e.g., retentionpolicies, security, and the like).

The process 9000 continues to block 9080 and provides the provisioningtemplate to a provisioning program to provision the hosted computingenvironment. The provisioning program may include an open sourceprovisioning program, such as a Jenkins or a Chef tool.

In some embodiments, the process 8000 and/or 9000 may further includemapping the provisioning template to one or more components of thehosted computing environment. For example, the provisioning program maymap the provisioning template to one or more components and/or servicesof the hosted computing environment to provision the components tooperate the desired service. As result, the components in the hostedcomputing environment are provisioned so that the components areconfigured for network operation using the service resources that aredescribed in the provisioning template. In some embodiments, the buildengine 5010 may determine hosted computing environment componentrequirements according to the received input using information stored inone or more databases, such as database 5030. Further details relatingto mapping of the provisioning template to one or more components of thehosted computing environment are described above with respect to FIG. 5.

In some embodiments, the process 8000 and/or 9000 may further includeconfiguring each of the one or more components of the hosted computingenvironment based on the mapping of the provisioning template, whereineach of the one or more components are configured in parallel. Process8000 and/or 9000 may further include creating a cluster by installingsoftware components on the configured components of the hosted computingenvironment. In some embodiments, the cluster includes a search head,one or more indexers, a cluster master, and/or a license master. Forexample, the cluster may correspond to the cluster 4000 illustrated inFIG. 4. Further details relating to configuring the components of thehosted computing environment and installation of software components onthe configured components to create a cluster are described above withrespect to FIG. 5.

FIG. 10 shows an exemplary embodiment of a provisioning template 10000.In some embodiments, the provisioning template 10000 Includes a JSONfile or any other type of configuration file. The provisioning template10000 may be generated based on

one or more requirements that a user specifies using a graphicalinterface. For example, the user may specify that a service provided feya service provider must be able to handle a certain amount of storageand indexing of a customer's data per day. The provisioning template10000 may specify a configuration of a hosted computing environment thatis required based on the customer requirements. One or more buildservers running a provisioning program may use the provisioning template10000 to provision and configure the hosted computing environment.

The provisioning template 10000 includes multiple entries that includevarious environment attributes. Environment attributes included in theprovisioning template 10000 Include:

-   -   Stack ID    -   Domain    -   Repo Hostname    -   Zabbix Hostname(s)    -   SSN key pair name    -   Cloud vendor name/account    -   DNS vendor name/account    -   AWS type (default unless overridden in the provisioner)    -   License Server        -   Name of license-key databag (default: license_21 stackid>)        -   Domain Name Server (DNS) name of Licenser load balancer        -   DNS name of primary License Master        -   DNS name of standby License Master    -   Search Head        -   DNS name of Search Head load balancer        -   DNS name of primary Search Head        -   DNS name of standby Search Head        -   distributedSearch and replicationSettings parameters (for            distsearch conf)    -   Indexer        -   Port number to listen on for incoming S2S data (default to            9997)        -   Port number to listen for replicated data (default to 9887)        -   Port number for management port (default to 8089)    -   List of Clusters        -   Cluster number        -   DNS name of Cluster Master        -   Replication factor        -   Search factor            -   List of Indexer peers    -   List of Index configurations        -   Index Name        -   Retention Policy        -   Other arbitrary index configuration key/values

Embodiments of the subject matter and the functional operationsdescribed in this specification can be implemented in digital electroniccircuitry, or in computer software, firmware, or hardware, including thestructures disclosed in this specification and their structuralequivalents, or in combinations of ones or more of them. Embodiments ofthe subject matter described in this specification can fee implementedas one or more computer program products, i.e., one or more modules ofcomputer program instructions encoded on a computer readable medium forexecution by, or to control the operation of, data processing apparatus.

The computer readable medium can be a machine readable storage device, amachine readable storage substrate, a memory device, a composition ofmatter effecting a machine readable propagated signal, or a combinationof one or more of them. The term “data processing apparatus” encompassesall apparatus, devices, and machines for processing data, including byway of example a programmable processor, a computer, or multipleprocessors or computers. The apparatus can include, in addition tohardware, code that creates an execution environment for the computerprogram in question, e.g., code that constitutes processor firmware, aprotocol stack, a database management system, an operating system, or acombination of one or more of them, A propagated signal is anartificially generated signal, e.g., a machine generated electrical,optical, or electromagnetic signal, that is generated to encodeinformation for transmission to suitable receiver apparatus.

A computer program (also known as a program, software, softwareapplication, script, or code), can be written in any form of programminglanguage, including compiled or interpreted languages, and it can bedeployed in any form, including as a stand-alone program or as a module,component, subroutine, or other unit suitable for use in a computingenvironment. A computer program does not necessarily correspond: to afile in a file system. A program can be stored in a portion of a filethat holds other programs or data (e.g., on or more scripts stored in amarkup language document), in a single file dedicated to the program inquestion, or in multiple coordinated files (e.g., files that store oneor more modules, sub programs, or portions of code). A computer programcan be deployed to be executed on one computer or on multiple computersthat are located at one site or distributed across multiple sites andinterconnected by a communication network.

The processes and logic flows described in this specification can beperformed by one or more programmable processors executing one or morecomputer programs to perform functions by operating on Input data andgenerating output. The processes and logic flows can also be performedby, and apparatus can also be implemented as, special purpose logiccircuitry, e.g., an FPGA (field programmable gate array) or an ASIC(application specific integrated circuit).

Processors suitable for the execution of a computer program include, byway of example, both general and special purpose microprocessors, andany one or more processors of any kind of digital computer. Generally, aprocessor will receive instructions and data from a read only memory ora random access memory or both. The essential elements of a computer area processor for performing instructions and one or more memory devicesfor storing instructions and data. Generally, a computer will alsoinclude, or be operatively coupled to receive data from or transfer datato, or both, one or more mass storage devices for storing data, e.g.,magnetic, magneto optical disks, or optical disks. However, a computerneed not have such devices. Moreover, a computer can be embedded inanother device, e.g., a mobile telephone, a personal digital assistant(PDA), a mobile audio player, a Global Positioning System (GPS)receiver, to name just a few. Computer readable media suitable forstoring computer program instructions and data include all forms ofnonvolatile memory, media, and memory devices, including by way ofexample semiconductor memory devices, e.g., EPROM, EEPROM, and flashmemory devices; magnetic disks, e.g., infernal hard disks or removabledisks; magneto optical disks; and CD ROM and DVD ROM disks. Theprocessor and the memory can be supplemented, by, or incorporated in,special purpose logic circuitry.

To provide for interaction with a user, architecture provider orreviewer, embodiments of the subject matter described in thisspecification can be implemented on a computer having a display device,e,g., a CRT (cathode ray tube) to LCD (liquid crystal display) monitor,for displaying information to the user and a keyboard and a pointingdevice, e.g., a mouse or a trackball, by which the user can provideInput to the computer. Other kinds of devices can be used to provide forinteraction with a user, architecture provider or reviewer as well; forexample, feedback provided to the user can be any form of sensoryfeedback, e.g., visual feedback, auditory feedback, or tactile feedback:and input from the user, architecture provider or reviewer can bereceived in any from, including acoustic, speech, or tactile input.

Embodiments of the subject matter described in this specification can beimplemented in a computing system that includes a hack end component,e.g., as a data server, or that includes a middleware component, e.g.,an application server, or that includes a front end component, e.g., aclient computer having a graphical user interface or a Web browserthrough which a user can interact with an Implementation of the subjectmatter described in this specification, or any combination of one ormore such back end, middleware, or front end components. The componentsof the system can be interconnected by any form or medium of digitaldata communication, e.g., a communication network. Examples ofcommunication networks include a local area network (“LAN” ) and a widearea network (“WAN”), e.g., the Internet.

The computing system can include clients and servers. A client andserver are generally remote from each other and typically interactthrough a communication network. The relationship of client and serverarises by virtue of computer programs running on the respectivecomputers and having a client server relationship to each other.

While this specification contains many specifics, these should not beconstrued as limitations on the scope of the invention or of what may beclaimed, but rather as descriptions of features specific to particularembodiments of the invention. Certain features that are described inthis specification in the context or separate embodiments can also beimplemented in combination in a single embodiment. Conversely, variousfeatures that are described In the context of a single embodiment canalso be implemented in multiple embodiments separately or in anysuitable subcombination. Moreover, although features may be describedabove as acting in certain combinations and even initially claimed assuch, one or more features from a claimed combination can in some casesbe excised from the combination, and the claimed combination may bedirected to a subcombination or variation of a subcombination.

Similarly, while operations are depicted in the drawings in a particularorder, this should not be understood as requiring that such operationsbe performed In the particular order shown or in sequential order, orthat all illustrated operations be performed, to achieve desirableresults. In certain circumstances, multitasking and parallel processingmay be advantageous. Moreover, the separation of various systemcomponents in the embodiments described above should not be understoodas requiring such separation in all embodiments, and it should beunderstood that the described program components and systems cangenerally be integrated together in a single software product orpackaged into multiple software products.

Thus, particular embodiments of the invention have been described. Otherembodiments are within the scope of the following claims. For example,the actions recited in the claims can be performed in a different orderand still achieve desirable results.

1-30. (canceled)
 31. A computer-implemented method for provisioning ahosted computing environment according to user-specified input,comprising: causing a graphical interface to be generated on a computingdevice; receiving, via the graphical user interface, one or morerequirements relating to running a service in a hosted computingenvironment; converting the received requirements into correspondingentries populating a provisioning template having a plurality ofentries; if, as a result of the converting, all entries of theprovisioning template have been populated, providing the provisioningtemplate to a provisioning program to provision the hosted computingenvironment for the service; and if one or more entries of theprovisioning template remain unpopulated after the converting, then:automatically determining additional requirements for provisioning thehosted computing environment based on a rule and the receivedrequirements; and populating additional entries based on the determinedadditional requirements to complete the provisioning template, whereinthe template specifies hardware or a cloud computing environmentconfigured to meet the requirements.
 32. The method of claim 31, whereinthe rule is user-configurable.
 33. The method of claim 31, wherein theprovisioning program includes a Chef configuration management tool thatuses the provisioning template to instruct a hosted platform how toprovision the hosted computing environment.
 34. The method of claim 31,wherein the provisioning program includes a configuration managementtool.
 35. The method of claim 31, wherein the provisioning programincludes a configuration management tool that uses the provisioningtemplate to instruct a hosted platform how to provision the hostedcomputing environment.
 36. The method of claim 31, wherein the entriesof the provisioning template include both an indication of hardware anda virtual machine environment configured to meet the one or morerequirements.
 37. The method of claim 31, wherein the entries of theprovisioning template include an indication of hardware configured tomeet the one or more requirements, an indication of a a cloud computingenvironment configured to meet the one or more requirements, and anindication of software configured to meet the one or more requirements.38. The method of claim 31, wherein the graphical interface interfaceswith a Jenkins continuous integration tool.
 39. The method of claim 31,wherein the graphical interface interfaces with a continuous integrationtool.
 40. The method of claim 31, wherein the service to which the oneor more requirements relate includes indexing, searching, retrieval, orstorage of data in the hosted computing environment.
 41. The method ofclaim 31, wherein the service to which the one or more requirementsrelate includes a storage of data derived from machine data.
 42. Themethod of claim 31, wherein the service to which the one or morerequirements relate includes a storage of events derived from machinedata.
 43. A system for provisioning a hosted computing environmentaccording to user-specified input, comprising: one or more dataprocessors; and a non-transitory computer-readable storage mediumcoupled to the one or more processors containing instructions which whenexecuted on the one or more data processors, cause the one or moreprocessors to perform operations including: causing a graphicalinterface to be generated on a computing device; receiving, via thegraphical user interface, one or more requirements relating to running aservice in a hosted computing environment; converting the receivedrequirements into corresponding entries populating a provisioningtemplate having a plurality of entries; if, as a result of theconverting, all entries of the provisioning template have beenpopulated, providing the provisioning template to a provisioning programto provision the hosted computing environment for the service; and ifone or more entries of the provisioning template remain unpopulatedafter the converting, then: automatically determining additionalrequirements for provisioning the hosted computing environment based ona rule and the received requirements; and populating additional entriesbased on the determined additional requirements to complete theprovisioning template, wherein the template specifies hardware or acloud computing environment configured to meet the requirements.
 44. Thesystem of claim 43, wherein the rule is user-configurable.
 45. Thesystem of claim 43, wherein the provisioning program includes aconfiguration management tool that uses the provisioning template toinstruct a hosted platform how to provision the hosted computingenvironment.
 46. The system of claim 43, wherein the entries of theprovisioning template include both an indication of hardware and a cloudcomputing environment configured to meet the one or more requirements.47. The system of claim 43, wherein the entries of the provisioningtemplate include an indication of hardware configured to meet the one ormore requirements, an indication of a a cloud computing environmentconfigured to meet the one or more requirements, and an indication ofsoftware configured to meet the one or more requirements.
 48. The systemof claim 43, wherein the graphical interface interfaces with acontinuous integration tool.
 49. The system of claim 43, wherein theservice to which the one or more requirements relate includes indexing,searching, retrieval, or storage of data in the hosted computingenvironment.
 50. The system of claim 43, wherein the service to whichthe one or more requirements relate includes a storage of data derivedfrom machine data.
 51. A computer-program product tangibly embodied in anon-transitory machine-readable storage medium, including instructionsconfigured to cause one or more data processors to: cause a graphicalinterface to be generated on a computing device; receive, via thegraphical user interface, one or more service requirements relating torunning a service in a hosted computing environment; p1 convert thereceived requirements into corresponding entries populating aprovisioning template having a plurality of entries; if, as a result ofthe converting, all entries of the provisioning template have beenpopulated, providing the provisioning template to a provisioning programto provision the hosted computing environment for the service; and ifone or more entries of the provisioning template remain unpopulatedafter the converting, then: automatically determining additionalrequirements for provisioning the hosted computing environment based ona rule and the received requirements; and populating additional entriesbased on the determined additional requirements to complete theprovisioning template, wherein the template specifies hardware or acloud computing environment configured to meet the requirements.
 52. Thecomputer-program product of claim 51, wherein the rule isuser-configurable.
 53. The computer-program product of claim 51, whereinthe provisioning program includes a configuration management tool thatuses the provisioning template to instruct a hosted platform how toprovision the hosted computing environment.
 54. The computer-programproduct of claim 51, wherein the entries of the provisioning templateinclude both an indication of hardware and a virtual machine environmentconfigured to meet the one or more requirements.
 55. Thecomputer-program product of claim 51, wherein the entries of theprovisioning template include an indication of hardware configured tomeet the one or more requirements, an indication of a cloud computingenvironment configured to meet the one or more requirements, and anindication of software configured to meet the one or more requirements.56. The computer-program product of claim 51, wherein the graphicalinterface interfaces with a Jenkins continuous integration tool.
 57. Thecomputer-program product of claim 51, wherein the graphical interfaceinterfaces with a continuous integration tool.
 58. The computer-programproduct of claim 51, wherein the service to which the one or morerequirements relate includes indexing, searching, retrieval, or storageof data in the hosted computing environment.
 59. The computer-programproduct of claim 51, wherein the service to which the one or morerequirements relate includes a storage of data derived from machinedata.
 60. The computer-program product of claim 51, wherein the serviceto which the one or more requirements relate includes a storage ofevents derived from machine data.